Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 20:45
Static task
static1
Behavioral task
behavioral1
Sample
tmp6x00xzqq.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
tmp6x00xzqq.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240220-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240426-en
General
-
Target
tmp6x00xzqq.exe
-
Size
701KB
-
MD5
cd46396fa20831c4ec0acea6534d020f
-
SHA1
1736c61d635cc61d8e9ec6b0dd15ddf814657fc5
-
SHA256
c90f02f4c4f58772131c5fc1b8cc8acc647005189e1abd87ecae379a41b0eac8
-
SHA512
b40e2fe2faab4a4faf3c6e82cd778868fb275e41b55f40a6f566eecab23aac42e0956b261b124c47849bcc8d6a4809192c5ec21e301d8d513b9391571b7cdc91
-
SSDEEP
12288:Cvp1DrAkngRmfxs7ZsGYAG5utPHH9oTHhwOR6bu:enDrA/mfWZsGY7+0ho
Malware Config
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Loads dropped DLL 1 IoCs
Processes:
tmp6x00xzqq.exepid process 2256 tmp6x00xzqq.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
tmp6x00xzqq.exetmp6x00xzqq.exepid process 2256 tmp6x00xzqq.exe 2808 tmp6x00xzqq.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
tmp6x00xzqq.exedescription pid process target process PID 2256 set thread context of 2808 2256 tmp6x00xzqq.exe tmp6x00xzqq.exe -
Drops file in Windows directory 2 IoCs
Processes:
tmp6x00xzqq.exedescription ioc process File opened for modification C:\Windows\resources\0409\stanse\selenitic.imp tmp6x00xzqq.exe File opened for modification C:\Windows\Fonts\humanhood.krs tmp6x00xzqq.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
tmp6x00xzqq.exepid process 2256 tmp6x00xzqq.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
tmp6x00xzqq.exedescription pid process target process PID 2256 wrote to memory of 2808 2256 tmp6x00xzqq.exe tmp6x00xzqq.exe PID 2256 wrote to memory of 2808 2256 tmp6x00xzqq.exe tmp6x00xzqq.exe PID 2256 wrote to memory of 2808 2256 tmp6x00xzqq.exe tmp6x00xzqq.exe PID 2256 wrote to memory of 2808 2256 tmp6x00xzqq.exe tmp6x00xzqq.exe PID 2256 wrote to memory of 2808 2256 tmp6x00xzqq.exe tmp6x00xzqq.exe PID 2256 wrote to memory of 2808 2256 tmp6x00xzqq.exe tmp6x00xzqq.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp6x00xzqq.exe"C:\Users\Admin\AppData\Local\Temp\tmp6x00xzqq.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp6x00xzqq.exe"C:\Users\Admin\AppData\Local\Temp\tmp6x00xzqq.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nstA0E2.tmp\System.dllFilesize
11KB
MD50ff2d70cfdc8095ea99ca2dabbec3cd7
SHA110c51496d37cecd0e8a503a5a9bb2329d9b38116
SHA256982c5fb7ada7d8c9bc3e419d1c35da6f05bc5dd845940c179af3a33d00a36a8b
SHA512cb5fc0b3194f469b833c2c9abf493fcec5251e8609881b7f5e095b9bd09ed468168e95dda0ba415a7d8d6b7f0dee735467c0ed8e52b223eb5359986891ba6e2e
-
memory/2256-10-0x0000000002830000-0x00000000048E9000-memory.dmpFilesize
32.7MB
-
memory/2256-11-0x0000000002830000-0x00000000048E9000-memory.dmpFilesize
32.7MB
-
memory/2256-12-0x0000000077241000-0x0000000077342000-memory.dmpFilesize
1.0MB
-
memory/2256-13-0x0000000077240000-0x00000000773E9000-memory.dmpFilesize
1.7MB
-
memory/2256-21-0x0000000002830000-0x00000000048E9000-memory.dmpFilesize
32.7MB
-
memory/2808-14-0x0000000077240000-0x00000000773E9000-memory.dmpFilesize
1.7MB
-
memory/2808-15-0x00000000004E0000-0x0000000001542000-memory.dmpFilesize
16.4MB